Hackers exploited a critical Cisco Catalyst SD-WAN vulnerability (CVE-2026-20127, CVSS 10.0) to deploy custom malware called KeyDrift, which is designed to steal AES-256 encryption keys used to secure traffic between network sites. The malware hooks into core SD-WAN processes to intercept and exfiltrate keys, encrypted with RSA, and also includes backdoor and relay capabilities. The attacks have been linked to infrastructure associated with Volt Typhoon, a Chinese state-sponsored cyber group, though Cisco Talos stops short of directly attributing the campaign to them.
